Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
transferencia_BBVA_97866456345354678976543425678.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\autB4C4.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\autB523.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\reindulging
|
ASCII text, with very long lines (28714), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\wainage
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\transferencia_BBVA_97866456345354678976543425678.exe
|
"C:\Users\user\Desktop\transferencia_BBVA_97866456345354678976543425678.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\transferencia_BBVA_97866456345354678976543425678.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://account.dyn.com/
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://ip-api.com/line/?fields=hosting
|
208.95.112.1
|
||
|
http://ip-api.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
ip-api.com
|
208.95.112.1
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
208.95.112.1
|
ip-api.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
DD0000
|
direct allocation
|
page read and write
|
|
|
|
402000
|
system
|
page execute and read and write
|
|
|
|
CF0000
|
heap
|
page execute and read and write
|
||
|
423000
|
unkown
|
page write copy
|
||
|
3A8E000
|
direct allocation
|
page read and write
|
||
|
113A000
|
heap
|
page read and write
|
||
|
4C52000
|
trusted library allocation
|
page read and write
|
||
|
1017000
|
heap
|
page read and write
|
||
|
DC0000
|
direct allocation
|
page execute and read and write
|
||
|
6037000
|
trusted library allocation
|
page read and write
|
||
|
A8D000
|
heap
|
page read and write
|
||
|
361000
|
unkown
|
page execute read
|
||
|
BFC000
|
stack
|
page read and write
|
||
|
6060000
|
trusted library allocation
|
page read and write
|
||
|
4C5A000
|
trusted library allocation
|
page read and write
|
||
|
1017000
|
heap
|
page read and write
|
||
|
A23000
|
heap
|
page read and write
|
||
|
361000
|
unkown
|
page execute read
|
||
|
3749000
|
trusted library allocation
|
page read and write
|
||
|
5E0000
|
heap
|
page read and write
|
||
|
4C90000
|
trusted library allocation
|
page read and write
|
||
|
1149000
|
heap
|
page read and write
|
||
|
1017000
|
heap
|
page read and write
|
||
|
4C6D000
|
trusted library allocation
|
page read and write
|
||
|
D70000
|
heap
|
page read and write
|
||
|
5CE000
|
stack
|
page read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
940000
|
trusted library allocation
|
page read and write
|
||
|
27E2000
|
trusted library allocation
|
page read and write
|
||
|
3750000
|
direct allocation
|
page read and write
|
||
|
1017000
|
heap
|
page read and write
|
||
|
38F0000
|
direct allocation
|
page read and write
|
||
|
F80000
|
heap
|
page read and write
|
||
|
3873000
|
direct allocation
|
page read and write
|
||
|
4C4E000
|
trusted library allocation
|
page read and write
|
||
|
60B0000
|
heap
|
page read and write
|
||
|
3750000
|
direct allocation
|
page read and write
|
||
|
4F8E000
|
stack
|
page read and write
|
||
|
38F0000
|
direct allocation
|
page read and write
|
||
|
3A8E000
|
direct allocation
|
page read and write
|
||
|
4E30000
|
heap
|
page read and write
|
||
|
3EF000
|
unkown
|
page readonly
|
||
|
FA4000
|
heap
|
page read and write
|
||
|
2721000
|
trusted library allocation
|
page read and write
|
||
|
3789000
|
trusted library allocation
|
page read and write
|
||
|
4C80000
|
trusted library allocation
|
page read and write
|
||
|
CBE000
|
stack
|
page read and write
|
||
|
EA0000
|
heap
|
page read and write
|
||
|
6050000
|
trusted library allocation
|
page execute and read and write
|
||
|
1004000
|
heap
|
page read and write
|
||
|
1004000
|
heap
|
page read and write
|
||
|
DB0000
|
heap
|
page read and write
|
||
|
3873000
|
direct allocation
|
page read and write
|
||
|
9DA000
|
heap
|
page read and write
|
||
|
1017000
|
heap
|
page read and write
|
||
|
1149000
|
heap
|
page read and write
|
||
|
4C61000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
6040000
|
trusted library allocation
|
page read and write
|
||
|
57E000
|
stack
|
page read and write
|
||
|
3A1D000
|
direct allocation
|
page read and write
|
||
|
48FD000
|
stack
|
page read and write
|
||
|
9B0000
|
heap
|
page read and write
|
||
|
3750000
|
direct allocation
|
page read and write
|
||
|
5EEE000
|
stack
|
page read and write
|
||
|
DA4000
|
heap
|
page read and write
|
||
|
3873000
|
direct allocation
|
page read and write
|
||
|
10F2000
|
heap
|
page read and write
|
||
|
360000
|
unkown
|
page readonly
|
||
|
428000
|
unkown
|
page readonly
|
||
|
360000
|
unkown
|
page readonly
|
||
|
FE6000
|
heap
|
page read and write
|
||
|
415000
|
unkown
|
page readonly
|
||
|
47FC000
|
stack
|
page read and write
|
||
|
508E000
|
stack
|
page read and write
|
||
|
944000
|
trusted library allocation
|
page read and write
|
||
|
3A19000
|
direct allocation
|
page read and write
|
||
|
3A8E000
|
direct allocation
|
page read and write
|
||
|
53ED000
|
stack
|
page read and write
|
||
|
1B7E000
|
stack
|
page read and write
|
||
|
5AB0000
|
heap
|
page read and write
|
||
|
177F000
|
stack
|
page read and write
|
||
|
3A1D000
|
direct allocation
|
page read and write
|
||
|
966000
|
trusted library allocation
|
page execute and read and write
|
||
|
6030000
|
trusted library allocation
|
page read and write
|
||
|
BCE000
|
stack
|
page read and write
|
||
|
97B000
|
trusted library allocation
|
page execute and read and write
|
||
|
50CE000
|
stack
|
page read and write
|
||
|
1153000
|
heap
|
page read and write
|
||
|
6070000
|
trusted library allocation
|
page execute and read and write
|
||
|
1002000
|
heap
|
page read and write
|
||
|
53F0000
|
trusted library allocation
|
page read and write
|
||
|
FC0000
|
heap
|
page read and write
|
||
|
3A8E000
|
direct allocation
|
page read and write
|
||
|
DA0000
|
heap
|
page read and write
|
||
|
4DFC000
|
stack
|
page read and write
|
||
|
A93000
|
heap
|
page read and write
|
||
|
9B8000
|
heap
|
page read and write
|
||
|
38F0000
|
direct allocation
|
page read and write
|
||
|
3A8E000
|
direct allocation
|
page read and write
|
||
|
9E8000
|
heap
|
page read and write
|
||
|
F88000
|
heap
|
page read and write
|
||
|
1017000
|
heap
|
page read and write
|
||
|
AA9000
|
heap
|
page read and write
|
||
|
3873000
|
direct allocation
|
page read and write
|
||
|
281B000
|
trusted library allocation
|
page read and write
|
||
|
962000
|
trusted library allocation
|
page read and write
|
||
|
1037000
|
heap
|
page read and write
|
||
|
530E000
|
stack
|
page read and write
|
||
|
41F000
|
unkown
|
page read and write
|
||
|
60C0000
|
heap
|
page read and write
|
||
|
261F000
|
stack
|
page read and write
|
||
|
1149000
|
heap
|
page read and write
|
||
|
38F0000
|
direct allocation
|
page read and write
|
||
|
9E5000
|
heap
|
page read and write
|
||
|
3A19000
|
direct allocation
|
page read and write
|
||
|
5F2E000
|
stack
|
page read and write
|
||
|
590000
|
heap
|
page read and write
|
||
|
1159000
|
heap
|
page read and write
|
||
|
972000
|
trusted library allocation
|
page read and write
|
||
|
1017000
|
heap
|
page read and write
|
||
|
4CC0000
|
heap
|
page read and write
|
||
|
FF2000
|
heap
|
page read and write
|
||
|
580000
|
heap
|
page read and write
|
||
|
282A000
|
trusted library allocation
|
page read and write
|
||
|
2830000
|
trusted library allocation
|
page read and write
|
||
|
1017000
|
heap
|
page read and write
|
||
|
D50000
|
trusted library allocation
|
page read and write
|
||
|
51CE000
|
stack
|
page read and write
|
||
|
415000
|
unkown
|
page readonly
|
||
|
3873000
|
direct allocation
|
page read and write
|
||
|
3750000
|
direct allocation
|
page read and write
|
||
|
2817000
|
trusted library allocation
|
page read and write
|
||
|
1017000
|
heap
|
page read and write
|
||
|
A3D000
|
heap
|
page read and write
|
||
|
1002000
|
heap
|
page read and write
|
||
|
1017000
|
heap
|
page read and write
|
||
|
1149000
|
heap
|
page read and write
|
||
|
3A1D000
|
direct allocation
|
page read and write
|
||
|
3A19000
|
direct allocation
|
page read and write
|
||
|
1018000
|
heap
|
page read and write
|
||
|
4C40000
|
trusted library allocation
|
page read and write
|
||
|
4CA000
|
stack
|
page read and write
|
||
|
D60000
|
trusted library allocation
|
page read and write
|
||
|
FB4000
|
heap
|
page read and write
|
||
|
2795000
|
trusted library allocation
|
page read and write
|
||
|
5F0000
|
heap
|
page read and write
|
||
|
3A1D000
|
direct allocation
|
page read and write
|
||
|
4E40000
|
heap
|
page execute and read and write
|
||
|
2755000
|
trusted library allocation
|
page read and write
|
||
|
4C5E000
|
trusted library allocation
|
page read and write
|
||
|
FC0000
|
heap
|
page read and write
|
||
|
3A19000
|
direct allocation
|
page read and write
|
||
|
5ADD000
|
heap
|
page read and write
|
||
|
2802000
|
trusted library allocation
|
page read and write
|
||
|
3A19000
|
direct allocation
|
page read and write
|
||
|
96A000
|
trusted library allocation
|
page execute and read and write
|
||
|
4CB0000
|
heap
|
page read and write
|
||
|
112A000
|
heap
|
page read and write
|
||
|
94D000
|
trusted library allocation
|
page execute and read and write
|
||
|
FBB000
|
heap
|
page read and write
|
||
|
4CB3000
|
heap
|
page read and write
|
||
|
6090000
|
trusted library allocation
|
page read and write
|
||
|
38F0000
|
direct allocation
|
page read and write
|
||
|
7F450000
|
trusted library allocation
|
page execute and read and write
|
||
|
3A1D000
|
direct allocation
|
page read and write
|
||
|
990000
|
heap
|
page read and write
|
||
|
604B000
|
trusted library allocation
|
page read and write
|
||
|
428000
|
unkown
|
page readonly
|
||
|
3721000
|
trusted library allocation
|
page read and write
|
||
|
4C72000
|
trusted library allocation
|
page read and write
|
||
|
38F0000
|
direct allocation
|
page read and write
|
||
|
95D000
|
trusted library allocation
|
page execute and read and write
|
||
|
960000
|
trusted library allocation
|
page read and write
|
||
|
FB3000
|
heap
|
page read and write
|
||
|
A6F000
|
heap
|
page read and write
|
||
|
CE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
41F000
|
unkown
|
page write copy
|
||
|
8F9000
|
stack
|
page read and write
|
||
|
62B0000
|
trusted library allocation
|
page read and write
|
||
|
3750000
|
direct allocation
|
page read and write
|
||
|
FB3000
|
heap
|
page read and write
|
||
|
4728000
|
trusted library allocation
|
page read and write
|
||
|
27E8000
|
trusted library allocation
|
page read and write
|
||
|
530000
|
heap
|
page read and write
|
||
|
3EF000
|
unkown
|
page readonly
|
||
|
3A8E000
|
direct allocation
|
page read and write
|
||
|
FF3000
|
heap
|
page read and write
|
||
|
930000
|
trusted library allocation
|
page read and write
|
||
|
D80000
|
heap
|
page read and write
|
||
|
3873000
|
direct allocation
|
page read and write
|
||
|
D76000
|
heap
|
page read and write
|
||
|
602E000
|
stack
|
page read and write
|
||
|
3750000
|
direct allocation
|
page read and write
|
||
|
BBF000
|
stack
|
page read and write
|
||
|
943000
|
trusted library allocation
|
page execute and read and write
|
||
|
9A0000
|
trusted library allocation
|
page read and write
|
||
|
4C46000
|
trusted library allocation
|
page read and write
|
||
|
4C66000
|
trusted library allocation
|
page read and write
|
||
|
520D000
|
stack
|
page read and write
|
||
|
FC0000
|
heap
|
page read and write
|
||
|
977000
|
trusted library allocation
|
page execute and read and write
|
||
|
BDB000
|
stack
|
page read and write
|
||
|
27FA000
|
trusted library allocation
|
page read and write
|
||
|
4F4C000
|
stack
|
page read and write
|
||
|
4C4B000
|
trusted library allocation
|
page read and write
|
||
|
3A19000
|
direct allocation
|
page read and write
|
||
|
950000
|
trusted library allocation
|
page read and write
|
||
|
3A1D000
|
direct allocation
|
page read and write
|
||
|
5F5000
|
heap
|
page read and write
|
||
|
112A000
|
heap
|
page read and write
|
||
|
D00000
|
heap
|
page read and write
|
||
|
529000
|
stack
|
page read and write
|
There are 203 hidden memdumps, click here to show them.